5 Appendix A: exemplary source code for thor32.dll. 

// 

#include <windows.h> 
#include <TriceratMessaging.h> 
HINSTANCE InstanceHandle; 
1 0 bool Processed = false; 

extern "C" declspec(dllexport) void LoadThorA(); 

extern "C" declspec(dllexport) void UnloadThorA(); 

// Shared Data 

#pragma datajeg(". shared") // Make a new section that we'll make shared 
1 5 HHOOK hHook = 0; // HHOOK from SetWindowsHook 

#pragma data_seg0 

LRESULT CALLBACK GetMsgProc(int code, WPARAM wParam, LP ARAM lParam); 
#pragma argsused 

int WINAPI DllEntryPoint(HINSTANCE hinst, unsigned long reason, void* lpReserved) 
20 { 

HWND hWndMjolnir = NULL; 
InstanceHandle = hinst; 
DisableThreadLibrary Calls(hinst) ; 
if (IProcessed) 
25 { 

Processed = true; 

U hWndMjolnir = FindWindow("TMj olnirMainForm", NULL); 

□ if (NULL != hWndMjolnir) 

3 0-:1 SendMessage(hWndMjolnir, TM D2K CHECKALLOWEDAPP, 0, 

~1 GetCurrentProcessId()); 

:t; } ) 

return true; 

± } 

35m a- 

is void LoadThorA() 

IU hHook = SetWindowsHookEx(WH_CALLWNDPROC, (HOOKPROC)GetMsgProc, InstanceHandle, 0 ); 

U } 

4o: 0 // 

void UnloadThorAO 

; w UnhookWindowsHookEx(hHook); 
hHook = NULL; 

45 } 

//. 

LRESULT CALLBACK GetMsgProc(int code, WPARAM wParam, LPARAM lParam) 

{ 

LRESULT retValue = 0; 
50 HWND hWndMjolnir = NULL; 

if (IProcessed) 

{ 

Processed = true; 

hWndMjolnir = FindWindow('TMj olnirMainForm", NULL); 
55 if (NULL != hWndMjolnir) 

{ 

SendMessage(hWndMjolnir, TM_D2K_CHECKALLOWEDAPP, 0, 
GetCurrentProcessId()) ; 

} } 

60 ret Value = CallNextHookEx(hHook, code, wParam, lParam); 

return retValue; 

}//. 



5 Appendix B: exemplary source code for mjolnir.exe. 

// 

#include <vcl.h> 

#pragma hdrstop 

#include "MjolnirMainUnit.h" 
1 0 #include "UnallowedAppUnith" 

//- 

#pragma package(smart_init) 

#pragma link "Networklnfo" 

#pragma link "StBase" 
1 5 #pragma link "StShBase" 

#pragma link "StTrlcon" 

#pragma link "Networklnfo" 

#pragma resource "*.dfm" 

#pragma link "psapi.lib" 
20 typedef _stdcall bool (*LOADDLL)(); 

typedef _stdcall bool (*UNLOADDLL)(); 

static bool KillUserProcess(DWORD Processld); 

TMjolnirMainForm *MjolnirMainForm; 

// 

25 _fastcall TMjotairMainFonn::TMjolnirMairiForm(TComponent* Owner) 
: TForm(Owner) 

O PmpStarting = false; 
O DesktopStarting = false; 
3 0\I SwingMjolnir = false ; 

J| // 

f: void fastcall TMjolnirMainForm: :HookThor32() 

Si { 

35 if (NULL = hThor32Lib) 

h { 

J" ShowMessage("Unable to load Thor32.Dll"); 

: y Close(); 

j t } 

40 ; y LOADDLL pfhLoadDll = (LOADDLL)GetProcAddress(hThor32Lib, 

O "_LoadThorA") ; 

iU (*p£aLoadDll)0; 
} 

void fastcall TMjolnirMainForm: :UnhookThor32() 

45 { 

if(NULL==hThor32Lib) 

{ 

ShowMessage("Unable to load Thor32.Dll"); 
Close(); 

50 } 

UNLOADDLL pfnUnloadDll = (UNLOADDLL)GetProcAddress(hThor32Lib, 

"_UnloadThorA"); 
(*pfiiUnloadDll)(); 

} 

55 void _fastcall TMjolnirMainFonn::FormCreate(TObject *Sender) 

' { 

TRegistry *Reg = new TRegistryO; 
bool ThorlsDisabled = false; 
ShowWindow(Application->Handle, SW_HIDE); 
60 Session->Active = false; 

ProductID = TI_PRODUCT_DESK2Kl; 



5 Application->CreateFoim( classid(TLicenseForm), &LicenseForm); 

if ( ! LicenseForm-> ValidateLicense()) 
{ 

MessageBox(NULL, "desktop 2001 License has expired!", "triCerat License", 
MB OK | MBJCONERROR | MBSYSTEMMODAL); 
1 0 Application->Terminate() ; 

return; 

} 

delete LicenseForm; 

Reg->RootKey = HKEY_LOCAL_MACHINE; 
1 5 Reg->OpenKey("Software\\Tricerat\\Controls", true); 

try 

{ 

ThorlsDisabled = Reg->ReadBool("DisableThor"); 
if(ThorlsDisabled) 
20 { 

Reg->CloseKey(); 
delete Reg; 

Application->Terminate(); 
return; 

25 } 

} 

catch(...) 

B { 

.ssss. } 

3dri Reg->CloseKey(); 

2f R.eg->OpenKey("Software\\Tricerat\\Desktop 200 1 true); 

S try 

f LoadTimer->Interval = Reg->ReadInteger("MjolnirStartupDelay") * 1000; 

3 5tt! if (0 >= LoadTimer->Interval) 

, - { 

Q. LoadTimer->Interval = 1 0000; 

il } 

40 : fi: catch(...) 

S { 

Reg->WriteInteger("MjolnirStartupDelay", 10); 
: * LoadTimer->Interval = 10000; 

} 

45 Reg->CloseKey(); 
delete Reg; 

TSecurity *sec = new TSecurity(); 

IsAdmin = sec->IsUserAdmin(getenv("COMPUTERNAME"), getenv("USERDOMAIN n ), 
getenv("USERNAME")); 
50 delete sec; 

hThor32Lib - LoadLibrary("Thor32.Dll"); 
wts = new TWtsToolsQ; 
HookThor32(); 

} 

55 //- 

void _fastcall TMjolnirMainForm::FonnActivate(TObject *Sender) 

{ 

ShowWindow(Application->Handle, SW_HIDE); 

} 

60 // 

void _fastcall TMjolnirMainForm::FormClose(TObject *Sender, TCloseAction &Action) 

{ 



5 UnhookThor32(); 

if (NULL !=hThor32Lib) 

{ 

FreeLibrary(hThor32Lib); 

} 

1 0 delete wts; 

} 

// 



void _fastcall TMjolnirMainForm::FormHide(TObject *Sender) 

{ 

1 5 ShowWindow(Application->Handle, SW HIDE); 

Top - 5000; 
Left = 5000; 

} 

//_ 

20 void _fastcall TMjolnirMainForm::HideTimerTimer(TObject *Sender) 

{ 

Hide(); 

} 

// 

25 void fastcall TMjolnirMainForm: :HookBitBtnClick(TObject *Sender) 

{ 

HookThor32(); 

S } 

£ //- 

30;;"! void _fastcall TMjolnirMainForni::UnhookBitBtnClick(TObject *Sender) 

1 { 

yr: UnhookThor32(); 

1 > 

4. //.. 

3 5 Ci void _fastcall TMjolnirMainForm: : AddOwners(TStrings * sql) 
{ 

Q sql->Add(" IN (SELECT ID FROM Owners WHERE Name = + 
fly FNetworkInfo->UserName + ""'); 

^ if (FNetworkInfo->LocalComputerName != ("WW" -1- FNetworkInfo->DomainName)) 

q FNetworkInfb->SourceServerName = FNetworldnfb->DomainControllerNarne ; 

jjj for (int i = 0; i < FNetworkInfb->MyGlobalGroupCount; i++) 

sql->Add(" OR Name - '" + FNetworkInfo->MyGlobalGroupNames[i] + ""»); 

45 FNetworkInfo->SourceServerName = 

for (inl i = 0; i < FNetworkInfo->MyLocalGroupCount; i++) 

sql->Add(" OR Name = '" + FNetworkInfo->MyLocalGroupNames[i] + "'"); 
if ( ! FNetworkInfo->ClientName.IsEmpty ()) 

sql->Add(" OR Name = + FNetworkInfo->ClientName + '""); 
50 if (!FNetworkInfo->LocalComputerName.IsEmpty()) 

sql->Add(" OR Name = + FNetworkInfo->LocalComputerName + "•'■); 
sql->Add(")"); 

} 

//- 



5 5 void _fastcall TMj olnirMainForm: : S tringGridInitialize() 

{ 

AllowedAppsStringGrid->RowCount = 1; 
AllowedAppsStringGrid->FixedRows = 0; 
AllowedAppsStringGrid->ColCount = 3; 
60 AllowedAppsStringGrid->ColWidths[0] = 100; 

AllowedAppsStringGrid->ColWidths[l] - 400; 
AllowedAppsStringGrid->ColWidths[2] = 50; 



AllowedAppsStringGrid->Refresh(); 
FirstRowOfStringGrid = true; 

} 

void _fastcall TMjolnirMainForm:: Load Alio wedExecutables() 
{ 

Session->Active = true; 
TQuery* query = new TQuery(NULL); 
AnsiString ParentProcess; 
AnsiString ProcessName; 

char szFileShortPath[MAXJPATH] = "unknown"; 

int InstanceLimit = 0; 

intj-0; 

StringGridInitialize(); 
query->UniDirectional = true; 
query->Constrained = true; 
query->RequestLive = false; 
query->DatabaseName = "Tricerat D2K1"; 

query->SQL->Add("SELECT DISTINCT ^Executable, e.InstanceLimit, e.Dependencies "); 
query->SQL->Add("FROM Executables e, StartMenuItems s, Owners o "); 
query->SQL->Add("WHERE "); 

query->SQL->Add("e.ID = s.ExecutablelD AND s.OwnerlD = o.ID "); 
query->SQL->Add("AND e.Disabled = False "); 
query->SQL->Add("AND s.OwnerlD "); 
AddOwners(query->SQL); 
try 

{ 

query->Open(); 

for (int i = 0; i < query->RecordCount; i++) 
{ 

try 

{ 

InstanceLimit = query->FieldByName("InstanceLimit")->AsInteger; 

catch(...) 

{ 

InstanceLimit = 1 ; 

} 

ProcessName = query->FieldByName("Executable")->AsString; 
if (0 != ExtractFileExt(ProcessName).AnsiCompareIC(".EXE ,r )) 

ProcessName = GetFileAssociation(ProcessName); 

} 

ParentProcess = 

ExtractFileName(ProcessName); 
AddAllowedApp(ParentProcess, ProcessName, InstanceLimit); 
AddDependencies(query->FieldByName("Dependencies")->AsString, 

ParentProcess, 9999); 
query->Next(); 

} 

} 

catch (...) 

{ 
} 

query->Close(); 
query->SQL->Clear(); 

query->SQL->Add("SELECT DISTINCT e.Executable, e.InstanceLimit, e.Dependencies "); 
query->SQL->Add("FROM Executables e, Desktopltems d, Owners o "); 
query->SQL->Add("WHERE "); 



5 query->SQL->Add("e.ID = d.ExecutablelD AND d.OwnerlD = o.ID "); 

query->SQL->Add("AND e.Disabled - False "); 
query->SQL->Add( M AND d.OwnerlD "); 
AddOwners(query->SQL); 
try 

10 { 

query->Open(); 

for (int i = 0; i < query->RecordCount; i++) 
{ 

try 

15 { 

InstanceLimit = query->FieldByName("InstanceLimit")->AsInteger; 

} 

catch(...) 

{ 

20 InstanceLimit = 1 ; 

} 

ProcessName = query->FieldByName( n Executable")->AsString; 

if (0 != ExtractFileExt(ProcessName).AnsiCompareIC( n .EXE")) 
25 { 

ProcessName = GetFileAssociation(ProcessName); 

t > 

I J ParentProcess = 

Q ExtractFileName(ProcessName) ; 

3 0 % J AddAllowedApp(ParentProcess, ProcessName, InstanceLimit); 

ifl AddDependencies(query->FieldByName("Dependencies")->AsString ? 

,£ a ParentProcess, 9999); 

query->Next(); 

35 m } } 

catch (...) 

^ query->Close(); 
40 hQ delete query; 

II SwingMjolnir = true; 

III Session->Active = false; 
} 

// 

45 bool _fastcall TMjolnirMainForm::AddAllowedApp(AnsiString ParentProcess, AnsiString AppPath, int Instances) 

//The TStringGrid has one row initialy, so don't add a new one. 
if (FirstRowOfStringGrid) 

{ 

50 FirstRowOfStringGrid = false; 

} 

else 

{ 

AllowedAppsStringGrid->RowCount-r-+; 

55 } 

AllowedAppsStringGrid->Cells[0][AllowedAppsStringGrid->RowCount- 1] = 
ParentProcess; 

AllowedAppsStringGrid->Cells[l][AllowedAppsStringGrid->RowCount - 1] = 
ResolveFileShortPath(AppPath); 
60 AllowedAppsStringGrid->Cells[2][AllowedAppsStringGrid->RowCount - 1] = 

String(Instances); 
return true; 



5 } 

void fastcall TMjolnirMainFonn::OnCheckAllowedApp(TMessage &Message) 

{ 

ValidateProcess(Messag'e.LParam); 

} 

10 //- 

bool fastcall TMjolnirMainForm::ValidateProcess(DWORD Processld) 

{ 

AnsiString ProcessPath; 
TStringList *RunningApps; 
1 5 bool InstanceCountExceeded = false; 

bool ParentProcessRunning = false; 
bool ValidProcess = false; 
int i = 0; 

if (ISwingMjolnir) 
20 { 

return true; 

} 

ProcessPath = GetProcessShortPath(ProcessId); 
if (ProcessPath.IsEmptyO) 
25 { 

return true; 

S } 

!S //Get the list of running apps. 
^ RunningApps = wts->GetSessionProcessList(); 
30 //Go through the Allowed Apps Grid and see if the Process is allowed to run. 

l S while (AllowedAppsStringGrid->RowCount > ++i) 

^ ^ { 

i'H if (0 = ProcessPath. AnsiCompareIC( 

3 5 is AllowedAppsStringGrid->Cells[ 1 ][i])) 

□ { 

v% i int AppCount = 0; 

U intj = 0; 

40 -1 //Check the instance count 

m j = " 1; 

while(RunningApps->Count > ++j) 
{ 

if (0 = RunningApps->StringsO].AnsiCompareIC( 
45 ExtractFileName(AllowedAppsStringGrid->Cells[l][i]))) 

{ 

AppCount++; 

} 

} 

50 if (AppCount > AllowedAppsStringGrid->Cells[2][i].ToIntDef(0)) 

{ 

InstanceCountExceeded = true; 

} 

//Try to find the Parent process. 
55 j = -l; 

while(RunningApps->Count > ++j) 
{ 

if (0 = RunningApps->Strings[j].AnsiCompareIC( 
AllowedAppsStringGrid->Cells[0][i])) 

60 { 

ParentProcessRunning = true; 

} 



5 } 

} 

if (!InstanceCountExceeded && ParentProcessRunning) 

{ 

ValidProcess = true; 
10 break; 
} 

} 

RunningApps->Clear(); 
delete RunningApps; 
15 //V alidate the Instance Count. 

if (InstanceCountExceeded) 

{ 

if (IsAdmin) 

{ 

20 MessageBox(NULL, "The program Instance Count has been exceededA 

\n\nPlease adjust the program Y'Instance Count LimitYV', 

"Instance COunt Exceeded", MB OK | MB_SYSTEMMODAL | MB JCONINFORMATION); 

} 

else 

25 { 

if (KillUserProcess(ProcessId)) 

% { 

'ff TInstanceLimitForm *Notify = new TInstanceLimitForm(NULL); 

Notify->ProcessPathLabel->Caption = ProcessPath; 
3(N Notify->ShowModal(); 
U1 delete Notify; 

; S } 

ill return false; 

35, } 

fj //Validate the process, 

nil if (! ValidProcess) 

\1 { 

if (IsAdmin) 

4QS { 

TAdminForm *admin = new TAdminForm(NULL); 
: - admin->ProcessEdit->Text = ProcessPath; 

admin->ShowModal(); 
delete admin; 

45 } 

else 

{ 

if (KillUserProcess(ProcessId)) 
{ 

50 TUnallowedAppForm *Notify = new TUnallowedAppForm(NULL); 

Notify->ProcessPathLabel->Caption = ProcessPath; 
Notify->ShowModal(); 
delete Notify; 

} 

55 } 

return false; 

} 

return true; 

} 

60 // 



AnsiString _fastcall TMjolnirMainForm::ResolveFileShortPath(AnsiString File) 

{ 



5 AnsiString Path; 

AnsiString FileShortPath; 
char szFileShortPath[MAX_PATH] = "unknown"; 
TDirTools *Dir = new TDirTools(); 
File = Dir->ParseEnvironment(File); 
10 delete Dir; 

Path = getenv("PATH"); 

Path = "A\;" + Path; 

if (ExtractFilePath(File).IsEmpty()) 

{ 

1 5 //For some reason, FileSearch() does not search the CurrentDir. 

if (FileExists(GetCurrentDir() + "W" + File)) 

{ 

File = GetCurrentDir() + "\\" + File; 

} 

20 else 

{ 

File = FileSearch(File, Path); 

} 

} 

25 GetShortPathName(File.c_str(), szFileShortPath, 

M= sizeof(szFileShortPath)); 
O FileShortPath = szFileShortPath; 
Q if (FileShortPath.IsEmptyO) 

Q { 
30m FileShortPath -File; 

i.n } 

« return FileShortPath; 

5 } 

3 5L AnsiString __fastcall TMjolnirMainForm: :GetProcessShortPath(DWORD Processld) 

HANDLE hProcess; 
1^ HMODULE hMod; 

! ll DWORD cbNeeded = 0; 
403 char szProcessPath[MAXJPATH] = "unknown"; 
ly char szProcessShortPath[MAXJPATH] = "unknown"; 

AnsiString Process ShortPath; 

hProcess = OpenProcess(PROCESS_QUERYJNFORMATION | PROCESS__VM__READ, FALSE, 
Processld); 

45 if (EnumProcessModules(hProcess, &hMod, sizeof(hMod), &cbNeeded)) 

{ 

//To get just the name of the process, call this: 

//GetModuleBaseName(hProcess, hMod, szProcessName, sizeof(szProcessName)); 
//Get the full path of the process. 
50 GetModuleFileNameEx(hProcess, hMod, szProcessPath, sizeof(szProcessPath)); 

GetShortPathName(szProcessPath, szProcessShortPath, 

sizeof(szProcessShortPath)) ; 
ProcessShortPath = szProcessShortPath; 

} 

5 5 CloseHandle(hProcess); 

return ProcessShortPath; 

} 

//. 

bool KillUserProcess(DWORD Processld) 
60 { 

HANDLE hProcess; 

hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, Processld); 



if(NULL = hProcess) 

return false; 
return TerminateProcess(hProcess, 0); 

} 

a- 



1 0 void fastcall TMjolnirMainForm: :OnDesktopInit(TMessage & Message) 

{ 

if (0 == Message.WParam) 

{ 

DesktopStarting = true; 
1 5 LoadTimer->Enabled = false; 

} 

if (1 ===== Message.WParam) 

{ 

DesktopStarting = false; 
20 if(!PmpStarting) 

{ 

InitializeMjolnirQ; 

} 

} 

25 } 

void fastcall TMjolnirMainForm: :OnPmpInit(TMessage & Message) 

rj if (0 = Message.WParam) 

3 OCj PmpStarting = true; 

LoadTimer->Enabled = false; 

S > 

't„: if (1 == Message.WParam) 

i ( 

35=^ PmpStarting = false; 

if ([DesktopStarting) 

5 * 

I'll InitializeMjolnir(); 

h } 
40)i| } 

II l void fastcall TMjolnirMainForm: :InitializeMjolmr() 

{ 

LoadAllowedExecutables() ; 

45 } 

void fastcall TMjolnirMainForm: :OnRefresh(TMessage & Message) 

{ 

InitializeMjolnir(); 

} 

50 void fastcall TMjolnirMainForm::LoadTimerTimer(TObject *Sender) 

{ 

LoadTimer->Enabled = false; 
InitializeMjolnir(); 

55 // 

void_fastcall TMjolnirMainForm: :RefreshBitBtnClick(TObject *Sender) 

{ 

InitializeMj olnir() ; 

} 

60 //- 

void fastcall TMjolnirMainForm::AddDependencies(AnsiString Delimited, 

AnsiString ParentProcess, int DefaultlnstanceLimit) 



5 { 

TStringList *ParsedStrings; 
int i = 0; 

if (Delimited.IsEmptyO) 
return; 

1 0 ParsedStrings = GetParsedStringList(Delimited); 

i— 1; 

while (ParsedStrings->Count > ++i) 
{ 

AddAliasDependencies(ParsedStrings->Strings[i], 
1 5 ParentProcess, DefaultlnstanceLimit); 

} 

} 

TStringList * fastcall TMjolnirMainForm::GetParsedStringList(AnsiString Delimited) 

{ 

20 TStringList *DelimitedCharList = new TStringList; 

TStringList *ParsedStrings = new TStringList(); 

TStringList *SubStrings; 

AnsiString FoundString; 

AnsiString RemainingString; 
25 bool SubStringsFound - false; 

int Index = 0; 

u int i = °; 

jlj intj = 0; 
jS; if (Delimited.IsEmptyO) 
3 0 return ParsedStrings ; 

DelimitedCharList->Add( T, ; n ); 
ff 1 DelimitedCharList->Add(","); 

•I- while (DelimitedCharList->Count > ++i) 

35m { 

•« Index = Delimited.AnsiPos(DelimitedCharList->Strings[i]); 

iij if (0>= Index) 

continue; 

40 ! f| SubStringsFound = true; 

1^ FoundString = Delimited. SubString(l ? Index - 1); 

^ RemainingString = Delimited. SubString(Index + 1, 

Delimited.Length() - Index); 
Substrings = GetParsedStringList(FoundString); 

45 j = 

while (SubStrings->Count > ++j) 
{ 

ParsedStrings->Add(SubStrings->Strings[j]); 

} 

50 delete Substrings; 

Substrings = GetParsedStringList(RemainingString); 

j = -i; 

while (SubStrings->Count > ++j) 
{ 

55 ParsedStrings->Add(SubStrings->Strings[j]); 

} 

delete Substrings; 

} 

if (! SubStringsFound) 
60 { 

ParsedStrings->Add(Delimited); 

} 



5 DelimitedCharList->Ciear(); 
delete DelimitedCharList; 
return ParsedStrings; 

} 

void _fastcall TMjolnirMainFonri::AddAliasDependencies(AnsiString Alias, 
1 0 AnsiString ParentProcess, int DefaultlnstanceLimit) 

{ 

if(FileExists(ResolveFileShortPath(Alias))) 

{ 

AddAllowedApp(ParentProcess, Alias, DefaultlnstanceLimit); 
1 5 return; 

} 

TQuery* query = new TQuery(NULL); 

query->UniDirectional = true; 

query- >Constrained = true; 
20 query- >RequestLive = false; 

query- >DatabaseName = "Tricerat D2K1"; 

query->SQL->Add("SELECT d.Path "); 

query- >SQL->Add("FROM Dependencies d "); 

query->SQL->Add("WHERE "); 
25 query->SQL->Add("d.Name = •" + Alias + ""*); 

try 

U { 

[~ query->Open(); 

for (int i = 0; i < query->RecordCount; i++) 

30U { 

2 AddAUowedApp(ParentProcess, 

j 5 ResolveFileShortPath(query->FieldByNam 

l M DefaultlnstanceLimit); 

:S query->Next(); 

35 m } 
} 

H catch (...) 

Fi i 
LI } 

40 query->Close(); 
~ delete query; 

;;J } 

; ~ AnsiString fastcall TMjolnirMainForm::GetFileAssociation(Ansi String File) 

{ 

45 AnsiString Association; 

AnsiString FilePath; 
AnsiString FileName; 
char szResultt 1024]; 

ZeroMemory(szResult, sizeof(szResult)); 
50 Association = File; 

File = ResolveFileShortPath(File); 
if(FileExists(File)) 

{ 

FileName = ExtractFileName(File); 
5 5 FilePath = ExtractFilePath(File); 

if (!FileName.IsEmptyO && !FilePath.IsEmpty()) 

{ 

if (32 < (int)FindExecutable(FileName.c_str(), FilePath.c_str(), szResult)) 

{ 

60 if (FileExists(szResult)) 

{ 

Association = szResult; } } } } return Association;} 
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